CVE-2025-2609

HighCVSS 8.2

Published: 21/03/2025(UTC)Updated: 28/08/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.10%

63th percentile - higher than 63% of all known CVEs

Summary

In MagnusBilling up to version 7.3.0, the file protected/components/MagnusLog.php contains a Cross-Site Scripting (XSS) vulnerability. Unauthenticated users can store malicious HTML content in login logs, which is then displayed in the log view component accessible at /mbilling/index.php/logUsers/read.

Risk Assessment

An attacker can inject a malicious script that executes in the browser of an administrator viewing the logs, potentially leading to session theft, account takeover, or theft of sensitive data.

Recommendation

Immediately update MagnusBilling to the latest available version that fixes this vulnerability. If an update is not possible, restrict access to the log interface to trusted administrators and apply input filtering in the MagnusLog.php file.

Other vulnerabilities in MagnusBilling

CVE-2025-2610High
In MagnusBilling up to version 7.3.0, a stored XSS vulnerability exists in the Alarm module. Improper input neutralization in the file protected/components/MagnusLog.Php allows an authenticated attacker to inject malicious scripts.

Original NVD description (English source)

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS